MCP servers fix six vulnerabilities in filesystem, Git and fetch

The MCP reference servers patch six security issues. Filesystem users should upgrade to 2.3.0; Git and fetch server users need the 2026.11.11 releases.

The brief

The Model Context Protocol reference server release addresses six vulnerabilities across three servers. The affected packages are the filesystem server, mcp-server-git, and mcp-server-fetch. The release lists the fixed versions as @modelcontextprotocol/server-filesystem 2.3.0 and 2026.11.11 for the Git and fetch servers. Teams that run these servers as local tools or in shared environments should compare their installed versions with the affected ranges in the original release notes.

One filesystem fix changes how reads open files after an allowed directory check. On Linux and macOS, reads now stay relative to the checked directory, closing a race where a directory could be swapped for a symlink between the check and the read. The release also refuses FIFOs, sockets and devices for that path. The Windows change narrows the race but does not close it, according to the maintainers. The source lists each vulnerability separately, so review the full advisory when assessing exposure and upgrading.